From f9b763fddc45eac16cf84fee068f08c49b70fc6f Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Fri, 21 Aug 2026 00:15:52 +0200 Subject: [PATCH] ci: pin github-workflows at v0.16.1 v0.16.1 renders the deploy artifact through the same checker the pull-request preview uses, so the artifact published on a tag and the scorecard shown on a PR are produced by one implementation rather than two copies of the same bash. It also records npm provenance as a boolean in the artifact contract deliberately rather than relying on how the toolkit coerces an unrecognised value. Every reusable workflow interface is unchanged from v0.16.0 -- same inputs, same required flags, same secrets. --- .github/workflows/deploy-preview.yml | 2 +- .github/workflows/publish.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml index 026d0dc..b5563cc 100644 --- a/.github/workflows/deploy-preview.yml +++ b/.github/workflows/deploy-preview.yml @@ -13,7 +13,7 @@ permissions: {} jobs: deploy-preview: - uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-validate.yml@bbcfef9e7127e5d8a6215a7142a0fa9cc2ad5055 # v0.16.0 + uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-validate.yml@6d4af5313cc39386fff796fa89ea940ef5f0819d # v0.16.1 with: deploy-dir: platform schema-version: 0.20.0 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f8ddca2..c76a952 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -171,7 +171,7 @@ jobs: # -- 3. Render and publish the deploy artifact ---------------------------- publish-deploy-artifact: needs: [resolve-image-lock] - uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@bbcfef9e7127e5d8a6215a7142a0fa9cc2ad5055 # v0.16.0 + uses: JorisJonkers-dev/github-workflows/.github/workflows/deploy-artifact.yml@6d4af5313cc39386fff796fa89ea940ef5f0819d # v0.16.1 with: ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }} artifact-name: agent-runtime